b-abderrahmane/cve-2021-29447-pocAutomates exploitation of CVE-2021-29447 in WordPress media upload to extract files via XXE, generating payloads and running an HTTP server for exfiltration.
This script automates the required steps to exploit CVE-2021-29447 in the media upload funnctionality in Wordpress and use it to extract files vi an XXE.
./generate_payloads.py --help
usage: generate_payloads.py [-h] [--local-ip LOCAL_IP] [--local-port LOCAL_PORT] [--media-payload MEDIA_PAYLOAD] [--dtd-payload DTD_PAYLOAD]
[--files-to-fetch FILES_TO_FETCH [FILES_TO_FETCH ...]]
CVE-2021-29447 payload generator
options:
-h, --help show this help message and exit
--local-ip LOCAL_IP Local machine IP address
--local-port LOCAL_PORT
Local machine port which will run an HTTP server to receive the exfiltrated files
--media-payload MEDIA_PAYLOAD
Name of the .wav file containing the exploit to be generated
--dtd-payload DTD_PAYLOAD
Name of the .dtd file containing the exploit to be generated
--files-to-fetch FILES_TO_FETCH [FILES_TO_FETCH ...]
The script does the following:
--media-payload to pass its name.--dtd-payload to pass its name. This file will contain the absolute paths of the files you would like to extract from the target machine, you can specific a list of comma separated files via --files-to-fetch.wav payload will connect back to both to fetch the second part of the payload (the DTD document) and to send the fetched files from the remote system.This software has been created purely for the purposes of research and for the development of effective mitigation techniques, and is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Use responsibly.